Jitter[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Jitter.exe
Size 12.3MB
Sample260728-2bbnaaxflb
SHA256 b3ee481b163083026576d92e20b26ded777502514b8cdde75156c03524fafbde
MD5 02bae6a52c61d11e5bacb2624e5578c2
SHA1 460a79e106d890a5d61d5d14f140c3ce467ea0f8
SHA512 483f18aaa48c727fa563d4d7cbe89d9570e1920183912e12c5c44f1c3b83775339d0d3bfa116d5242f52b1949f348dafc212c537ea4282102c0229d6cb57c70d
SSDEEP 196608:Z2retsjY3C33ss0uU0hp/zS0JbFOS+iSQ:ZRHds0uNhpG0
TLSH
T1CAD67D15B7A181E5D45A86348D9BDB8EE7B2BC140B3187DB32D0336E6E337D02E7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Jitter.exe

File Explorer

Jitter.exe

.exe 12.3MB

Jitter.exe

IMPHASH 897fb87a9d2b2ba51653e7890ef84afb
SHA256 b3ee481b163083026576d92e20b26ded777502514b8cdde75156c03524fafbde
MD5 02bae6a52c61d11e5bacb2624e5578c2
SHA1 460a79e106d890a5d61d5d14f140c3ce467ea0f8
SHA512 483f18aaa48c727fa563d4d7cbe89d9570e1920183912e12c5c44f1c3b83775339d0d3bfa116d5242f52b1949f348dafc212c537ea4282102c0229d6cb57c70d
SSDEEP 196608:Z2retsjY3C33ss0uU0hp/zS0JbFOS+iSQ:ZRHds0uNhpG0
TLSH
T1CAD67D15B7A181E5D45A86348D9BDB8EE7B2BC140B3187DB32D0336E6E337D02E7A611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6190928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Module32NextW K32GetProcessMemoryInfo CreateDirectoryW GetTempPathW GetFinalPathNameByHandleW ContinueDebugEvent WaitForDebugEvent DebugActiveProcess DebugActiveProcessStop GetTickCount64 FreeLibrary LoadLibraryExW DebugSetProcessKillOnExit DebugBreakProcess Heap32ListFirst Heap32ListNext Heap32First Heap32Next WriteFile GetModuleFileNameW GetModuleHandleExW LoadLibraryW GetModuleFileNameA DeleteFileA LockFileEx SetEvent CreateEventA OpenEventA MoveFileExA GetCurrentProcessId GetComputerNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryA AttachConsole FindFirstFileA FindNextFileA GetFileAttributesA GetEnvironmentVariableA FlushFileBuffers GetFileType SetFilePointer SetFilePointerEx SetErrorMode GetStdHandle OutputDebugStringW GetConsoleMode WriteConsoleW GetCurrentThreadId GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore WaitForSingleObjectEx CreateSemaphoreW ExitProcess GetSystemInfo RaiseException AddVectoredExceptionHandler RemoveVectoredExceptionHandler CreateThread GetCurrentThread SetThreadPriority SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetLocaleInfoW SetThreadExecutionState QueryPerformanceCounter QueryPerformanceFrequency CreateEventW GetTickCount IsWow64Process EnumResourceNamesW HeapFree GetProcessHeap VerSetConditionMask GetOverlappedResult CancelIo ResetEvent FormatMessageW VerifyVersionInfoW GetCommandLineW HeapAlloc WaitForMultipleObjects GetFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree ReadProcessMemory GetFileAttributesExW GetLogicalDrives RemoveDirectoryW CopyFileExW MoveFileExW DuplicateHandle SetHandleInformation CreatePipe SetNamedPipeHandleState GenerateConsoleCtrlEvent MulDiv Thread32Next CompareStringA GetSystemPowerStatus GetLocaleInfoA GetFileAttributesW GetFileInformationByHandle VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile HeapSize SetEnvironmentVariableW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext ReadConsoleW GetConsoleOutputCP SetStdHandle SetEndOfFile SetConsoleCtrlHandler TzSpecificLocalTimeToSystemTime SetFileTime FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetLocaleInfoEx CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable WakeConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime VirtualQueryEx VirtualProtectEx VirtualAllocEx GetSystemTimeAsFileTime GlobalMemoryStatusEx OpenProcess GetThreadTimes FlushInstructionCache SetThreadContext GetThreadContext GetProcessIdOfThread CreateProcessW ResumeThread SuspendThread GetExitCodeThread TerminateThread OpenThread CreateRemoteThread GetExitCodeProcess TerminateProcess GetCurrentProcess GetProcessTimes Sleep Module32FirstW Thread32First RtlUnwind Process32NextW Process32FirstW CreateToolhelp32Snapshot GetActiveProcessorCount LocalFree QueryThreadCycleTime GetProcAddress GetModuleHandleW VirtualFreeEx GlobalSize WriteProcessMemory WaitForSingleObject SetLastError ReadFile GetFileSizeEx FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCurrentDirectoryW WideCharToMultiByte GetTempPathA SetConsoleTitleA IsProcessorFeaturePresent FormatMessageA DeviceIoControl GetLastError CloseHandle CreateFileA FindFirstFileExW MultiByteToWideChar

user32

SetCursorPos ReleaseCapture SetCapture EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode GetKeyboardState GetKeyboardLayout SetWindowRgn IsClipboardFormatAvailable GetWindowTextA EnumWindows GetClassNameA EnumClipboardFormats RegisterClipboardFormatW GetClipboardSequenceNumber SystemParametersInfoW SystemParametersInfoA DrawTextW SetFocus GetDlgItem EndDialog DialogBoxIndirectParamW PostThreadMessageW GetMessageW GetWindowThreadProcessId GetActiveWindow LoadCursorW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard ShowWindow GetWindowLongW SetWindowLongW GetDoubleClickTime DestroyCursor CreateIconFromResourceEx RegisterWindowMessageA TrackMouseEvent TranslateMessage DispatchMessageW RegisterRawInputDevices GetRawInputData IsWindow CreateIconIndirect SetPropW ReleaseDC RegisterClassW SetWindowLongPtrW GetWindowLongPtrW SetForegroundWindow SetMenuItemInfoW GetMenuItemInfoW TrackPopupMenu DeleteMenu InsertMenuW EnableMenuItem CheckMenuItem AttachThreadInput SetLayeredWindowAttributes FlashWindowEx GetClipboardFormatNameA GetFocus EnableWindow SetActiveWindow RemovePropW SetWindowTextW GetWindowTextW GetQueueStatus CreateIconFromResource UnhookWindowsHookEx SetWindowsHookExW SetParent PtInRect IntersectRect ClipCursor GetClipCursor MessageBoxA GetWindowTextLengthW DestroyMenu CreatePopupMenu CreateWindowExW PeekMessageW GetMessagePos GetMessageTime GetMessageExtraInfo SendMessageW PostMessageW DefWindowProcW CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW SetWindowPos GetDesktopWindow GetWindowPlacement IsIconic IsZoomed GetKeyState GetAsyncKeyState MapVirtualKeyW MsgWaitForMultipleObjects SetTimer KillTimer GetSystemMetrics GetMenu GetForegroundWindow GetDC BeginPaint EndPaint GetUpdateRect ValidateRect GetPropW GetClientRect GetWindowRect AdjustWindowRectEx SetCursor GetCursorPos ClientToScreen ScreenToClient FillRect SetRectEmpty CallNextHookEx LoadIconW DestroyIcon MonitorFromPoint RegisterWindowMessageW DestroyWindow CreateWindowExA MonitorFromWindow GetMonitorInfoW GetRawInputDeviceInfoA GetRawInputBuffer GetRawInputDeviceList GetMessageA RegisterDeviceNotificationW UnregisterDeviceNotification UnregisterClassA RegisterClassExA

gdi32

BitBlt GetICMProfileW GetPixelFormat GetDIBits CreateDCW CreateCompatibleBitmap CreateRectRgn CombineRgn SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat GetTextMetricsW GetTextExtentPoint32A GetDeviceCaps CreateFontIndirectW CreateDIBSection SetPixel SelectObject DeleteDC CreateCompatibleDC CreateBitmap CreateSolidBrush DeleteObject

winmm

timeEndPeriod timeBeginPeriod

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetIMEFileNameA ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetCompositionFontW ImmNotifyIME ImmGetContext

ole32

ReleaseStgMedium CoCreateInstance CoInitializeEx CoUninitialize OleUninitialize OleInitialize CoTaskMemFree CLSIDFromString PropVariantClear RevokeDragDrop RegisterDragDrop

oleaut32

SysFreeString

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

advapi32

OpenProcessToken LookupPrivilegeValueW GetSecurityInfo SetSecurityInfo RegCloseKey RegCreateKeyExW RegOpenKeyExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegSetValueExW RegQueryValueExW AdjustTokenPrivileges

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiGetDeviceInstanceIdA

shell32

DragAcceptFiles SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW DragQueryFileW DragFinish Shell_NotifyIconW CommandLineToArgvW ShellExecuteA

comdlg32

GetSaveFileNameW GetOpenFileNameW

dbghelp

SymSetOptions SymLoadModuleExW SymEnumSymbols StackWalk64 SymFunctionTableAccess64 SymCleanup SymInitializeW SymInitialize SymGetModuleBase64 SymFromAddr

winhttp

WinHttpSendRequest WinHttpOpen WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptSetProperty BCryptGetProperty BCryptGenerateSymmetricKey BCryptGenerateKeyPair BCryptGenRandom BCryptEncrypt BCryptDecrypt BCryptExportKey BCryptImportKeyPair BCryptFinalizeKeyPair BCryptDestroyKey BCryptDestroySecret BCryptVerifySignature BCryptSecretAgreement BCryptDestroyHash BCryptDeriveKey BCryptCreateHash BCryptCloseAlgorithmProvider BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData CryptProtectData

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

146KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Jitter.exe

kernel32

user32

gdi32

winmm

imm32

ole32

oleaut32

version

advapi32

setupapi

shell32

comdlg32

dbghelp

winhttp

bcrypt

crypt32

generic